The Call Was Fake. The Wallet Was Real.

The meeting invite came from someone you trust. The face on the call was someone you know. The voice sounded right, the background looked right, and the small talk felt natural. None of it was real — and by the time the “audio fix” link appeared on screen, the trap was already closing.

The FBI says North Korean hackers have stolen more than $400 million in cryptocurrency through this scheme, codenamed FaceStealer, in the last 18 months. The cloud infrastructure behind the campaign has been seized — and the Justice Department separately seized more than $1.2 billion in cryptocurrency stolen by North Korea-linked TraderTraitor actors in the hack of the Binance exchange. The stolen funds, the Justice Department said, bankroll Pyongyang’s illicit weapons program.

How the trap works

The attack starts with a compromise. The operators — tracked as BlueNoroff, also known as APT38 — take over a victim’s messaging accounts, most often Telegram, and lock the real owner out. From there they work through the victim’s contact list, sending tailored meeting invitations to colleagues and contacts under the pretext of an investment opportunity. The hook is trust: the message comes from a real account belonging to a real person the target knows.

When a target shows interest, the attackers send a Calendly invite, then a link to join shortly before the meeting. The link is a lookalike: typosquatted domains such as uu01webzoom[.]us and teams.livemeet[.]us, dressed up as Zoom or Microsoft Teams. On the call itself, the attackers play a prerecorded webcam video of the trusted contact, sometimes alongside deepfake videos of well-known crypto and Web3 figures. The target sees a familiar face and relaxes.

A few seconds in, the performance begins. A mock technical error appears — the victim supposedly cannot be heard — and the “fix” is a link. Clicking it is a ClickFix-style lure: it installs malware that steals cryptocurrency and credentials and abuses the victim’s privileges on other infrastructure. Either way, the malware turns the target into the next victim, and the cycle repeats: new accounts hijacked, new contacts invited, new meetings staged.

Why it works so well

FaceStealer is a victim-acquisition machine: the attackers hijack Telegram, LinkedIn, Slack, and Discord accounts for extended periods and mine the victim’s contacts and chat history to make each approach personal. The deepfakes make it worse: the Justice Department said the hackers use what it calls “super intelligence” to build deepfakes of well-known crypto and Web3 figures, and Arctic Wolf says the operation now uses generative AI from ChatGPT, Google, Grok, and Wondershare for artwork, avatars, and synthetic participant videos — with likenesses scraped from YouTube interviews and conference talks.

The scale is large and growing. Arctic Wolf counted more than 400 victims across more than 20 countries in April 2026; the campaign has since expanded to 677 identified targets across 58 countries, more than 80 percent of them founders and C-suite executives. The FBI seized more than 900 victim webcam recordings used to impersonate people in follow-on attacks.

The wider campaign

FaceStealer is not the only North Korean social-engineering operation running right now. It is distinct from ClickFake Interview, an iteration of the Contagious Interview campaign that poses as recruiters on LinkedIn and delivers malware through rigged technical assessments. A joint advisory from agencies in Japan, the United States, Australia, and Germany estimated in late September 2026 that the long-running campaign had compromised at least 30,000 devices in 100 countries.

The delivery methods keep evolving: malware hidden in coding tests and repositories; Visual Studio Code tasks.json files that run malicious code the moment a project opens; .githooks scripts that fire on the first commit; trojanized macOS utility installers. Researchers at JFrog found the operators had even built a decoy company, AccuraSoftHire, with a careers site, LinkedIn page, and verified recruiters. Earlier this year, FaceStealer was used against the maintainer of the popular Axios npm package to push a trojanized version carrying a cross-platform remote access trojan.

What to do now

First, treat any meeting link as untrusted until you verify it through a second channel. If a trusted contact invites you to a call, confirm the meeting in a separate conversation — a fresh message, not a reply inside the same thread. Look closely at the domain: the FaceStealer lures hide behind near-identical Zoom and Teams addresses.

Second, never run a “fix” a meeting asks you to install. A real video call does not need you to download an update, run a script, or paste code into a terminal to restore audio. If a call presents a technical error and offers a download, leave the meeting and rejoin from the official app.

Third, if you handle code or hiring, make the rule explicit: interview assignments that arrive with downloads run only in a disposable virtual machine, never on a work laptop. Check when a recruiter’s profile was created and whether the company’s location matches on every page.

Finally, if you work in crypto or Web3, assume you are in the target set: founders and executives make up the overwhelming majority of FaceStealer’s targets. Move high-value holdings to hardware wallets, keep seed phrases offline, and treat any video meeting about an investment as a potential lure until proven otherwise. The FBI’s seizures disrupt this infrastructure, but the playbook — a familiar face, a fake glitch, a helpful link — is cheap to rebuild. For a closer look at how deepfake calls are used to move money, see our earlier report on the AI impersonation scheme that stole $129 million, and for the wider pattern of stolen AI credentials, our report on LLMjacking.